Fix CVE-2014-0139: Prevent wildcard certificates from matching IP addresses

[ysyrota]

Description

Fixed CVE-2014-0139 vulnerability in SSL certificate validation that incorrectly accepted wildcard patterns when validating IP addresses. Enhanced the _SSL_check_server_cert() function to properly distinguish between hostnames and IP addresses, preventing wildcard certificates from matching IP addresses while maintaining correct validation for legitimate hostname certificates.

Motivation and Context

CVE-2014-0139 is a security vulnerability where SSL certificate validation incorrectly accepts wildcard IP addresses in X.509 certificates, allowing potential man-in-the-middle attacks via crafted certificates issued by legitimate Certificate Authorities. This vulnerability was previously fixed in Duo Unix and needed to be addressed in libduo to ensure consistent security across both libraries.

The fix prevents attackers from using wildcard certificates (like *.example.com) to impersonate services accessed via IP addresses, closing a significant security gap.

How Has This Been Tested?

• Library compiles successfully without errors or warnings
• Verified no breaking changes to existing API
• Confirmed all CVE-2014-0139 attack vectors are mitigated

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)